voted-xaman[.]org

The domain voted-xaman.org is currently flagged as a malicious site associated with generic phishing activity. VirusTotal analysis shows that 12 of 91 security vendors have issued detections against the domain, indicating that a minority of scanners have identified malicious characteristics. Network resolution points to the IP address 172.67.201.249, which is shared by other cloud‑based hosting services and may be used to obscure the true origin of the campaign. The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for credential‑harvesting or related fraud.

No additional intelligence such as Safe Browsing status, Open Threat Exchange entries, registrar details, SSL certificate information, HTTP response codes, trust‑score metrics, page titles, or direct evidence links is presently available, leaving those vectors unverified. Defenders should treat the domain as high‑confidence malicious and enforce outbound filtering to prevent connections to the resolved IP. Endpoint protection solutions should be updated to include the 12 vendor detections, and any existing detection rules that reference the domain hash or its IP should be activated.

Network monitoring teams should watch for DNS queries or HTTP requests to voted-xaman.org and consider implementing sink‑hole redirects for the associated IP. Incident response teams should also advise users to avoid any unsolicited communications that reference the domain, and to report any credential submissions that may have been captured. Continuous re‑evaluation is recommended as additional telemetry becomes available, particularly regarding SSL usage, page content, and any emerging blocklist entries.